Vidar

Vidar is a dangerous malware that steals information and cryptocurrency from infected users. It derives its name from the ancient Scandinavian god of Vengeance. This upgraded version of Arkei stealer has been terrorizing the internet since 2018.

Type
Trojan
Origin
ex-USSR
First seen
1 December, 2018
Last seen
13 July, 2020
Also known as
Arkei
Global rank
20
Week rank
16
Month rank
14
IOCs
1747

What is Vidar / Arkei malware?

Vidar is an information stealer Trojan that was first identified in December 2018. It is either a fork of Arkei or the result of its evolution. Named after the god of vengeance from Scandinavian mythology, Vidar is used to steal information from infected machines, take screenshots, steal cryptocurrency and more.

General description of Vidar

Vidar is presumed to have originated in a Russian speaking country since the malware is configured to stop execution if it detects that it is being run on a machine that is located in one of the ex-USSR nations or on one that has a Russian keyboard layout.

Being another malware that is available for purchase based on the MaaS ( Malware-as-a-Service ) business model, Vidar can be purchased on its “official” website for a hefty price tag of $700, at least for the PRO version. Though, a stripped-down version of the malware can be obtained for just $250.

Vidar is written in C++ programming language. Purchasing account grants the attacker access to a control panel where the malware can be set up by the cybercriminal to target particular information on the victims’ PC. Similarly to Arkei, Cybercriminals need to take precautions to secure the main payload themselves, using a cryptor or a packer. The control panel displays the current builder version, user settings, malware status, and logs. It should be noted that domain names which Vidar uses to search for C&C servers, where stolen data is being dropped to, change every four days.

Vidar is capable of stealing text files in multiple formats, browser cookies and history, browser records, including data from TOR, as well as autofill value information including banking and credit card details. In addition, the malware can search for cryptocurrency wallet information, take screenshots and record private messages from various software.

What’s more, Vidar is also known to be able to steal digital coins from offline wallets. In fact, holders of Litecoin, Bitcoin, Ethereum, Zcash, and DashCore are in potential danger, as these are the cryptocurrencies currently supported by the malware.

After collecting all targeted information, the malware archives it and sends the stolen data to a control server, after which Vidar removes traces of its work and deletes itself from the system.

Vidar malware analysis

A video recorded in ANY.RUN malware hunting service allows us to take a closer look at the lifecycle of Vidar.

arkei execution process graph

Figure 1: A visual process graph generated by ANY.RUN

text report of the arkei malware analysis

Figure 2: The customizable text report provided by ANY.RUN is a perfect tool to share the results of an analysis

Vidar execution process

After the user downloads and runs a malicious file it spawns a child process and starts to collect information from the infected device. Often, after the information was collected the malware kills and deletes itself through a command-line command.

How to avoid infection by Vidar?

When spread via spam email campaigns, Vidar stealer requires the user to download and run a malicious file in order to enter an active state and begin execution. Therefore, following some basic online safety rules can ensure that users will stay safe from this malware.

As such, users should be careful when downloading attachments in emails from unknown senders. The best practice is to avoid downloading such files altogether, therefore not putting oneself in danger at all.

In addition, downloading only licensed software from trustworthy sources and avoiding gaming hacking clients greatly reduced the risk of being infected with malware such as Vidar which uses these attack vectors to infect victims.

The distribution process of Vidar

Like other malware, Vidar / Arkei is distributed through spam email campaigns as a malicious attachment. In addition, cases of Vidar being distributed using shady software and gaming hack clients have also been recorded. Vidar targets users all over the world with the exception of some ex-USSR countries, including Russia.

How to detect Vidar / Arkei using ANY.RUN?

Some malware creates files in which it named itself. You can find such info about Arkei trojan using ANY.RUN's "Static Discovering". Open either "Files" tab in the lower part of the task's window or click on the process and then on the button "More Info" in the appeared window. After that, all you need to do is just click on the file.

arkei vidar log file Figure 3: Arkei's log file

Conclusion

Vidar / Arkei is a highly dangerous information stealer trojan, distributed as malware as a service. Thanks to its extensive stealer feature set, Vidar trojan can be used to retrieve a wide variety of information, including steal select cryptocurrency coins from the users. Additionally, Vidar is capable of stealing data from TOR.

Thankfully, malware hunting services like ANY.RUN allows researchers to conduct extensive studies of malware samples in a secure environment, allowing them to spread information about the danger and develop effective countermeasures.

IOCs

IP addresses
88.99.66.31
208.95.112.1
176.123.8.59
78.142.29.223
31.41.43.1
89.45.67.160
18.205.93.1
77.222.62.31
18.205.93.0
18.205.93.2
51.210.135.23
185.50.25.50
79.124.78.56
141.8.192.151
208.95.112.1
185.26.105.244
169.239.128.22
185.212.130.11
192.99.1.185
192.52.167.67
Hashes
5275eb92b2b285585e26a85d14c9415e42fc4eac7c8b482e22910effb85536c5
a0895d6e66fd20aadb3821c56b294cf4923bb4b304eae9f47bd8bd558120422e
1cb51855c72dee3f92ccde539340a551c518ffc1554f40181c342edec9f60a61
8e37b2abdf3625b334f49a230a6a8b4603be97a8150c01641b9f41e7b58c0c8b
3b9f555888df6326a6a0c7dd2c2c1c2d78bbb969c1b7d40ea0d0e9679a06bbc5
32c17a6caeed78f79e06de58d5229927f77bc8c6b4865b41289d4da886a07df4
3a542702d224962f3c407f76f8f28ae2077003493e783479b60d178294e1ac45
197a888e426cc3b37142aa2f43c066078b73bd1424f51a6c4fe9d73a966dd573
83d8450c54c541ddceff68e7949b8709dfd557a79a4134d8434ca97df221de0e
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
e4692010fd3d0a88db68face738f5538ec067e3d2066f8d45ff1fe84ba5cb09d
11517f8dd5ab718ab0c77949e73b1960f3b34403b494af9271aea629a17350af
cf7c293553d105cbd7b27759375002efec2922f302117cc9b45cf594da205eba
89aa52670879880d5f52b3ee6e84381c3ea6121b0e9917905786a3d806faadf8
033741ca568e4e71a586be960e503415579b0520d2c9ecd298ed03becf406b9c
7dd09a71615dc2a60ba9dd906aebcff010f8442f4db392e4feb88baa01f8c999
f38a38d97bd96a42e8c3f985f1e65daca97dce229b36c8c80c9229666826f325
a0e30ade08be179fc1a1742b03ca6a85659ad123b05d5472228293200833cc84
c1b06231624dd9cd446357211a63f8d27f2a7781123c0dff89f277f95e408192
71f9070dd27e98928bc625109a2a4c01e4a3e308215fb7bc48306b0fad007d22
Domains
interludeeurope.com
isns.net
mammalson.com
majul.com
elx01.knas.systems
braif.ru
2no.co
optibet.ladesk.com
manillamemories.com
qxq.ddns.net
yip.su
krupskaya.com
m-onetrading-jp.com
thuocnam.tk
japanweterans.com
temp-mail.org
f0396918.xsph.ru
f0392210.xsph.ru
f0394028.xsph.ru
f0383399.xsph.ru

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More